Escape braces by default.

Xslate doesn't escape braces by current implementation.
AngularJS thinks braces are special chars.
In edge case, Xslate+AngularJS makes XSS.

This patch makes xslate, escape braces by default.

https://github.com/angular/angular.js/issues/5601