Fix toJSON so it doesn't emit </

We escape the sequence </ to <\/

Otherwise this would allow injection attacks.