preventing XSS attacks by escaping attributes in templates
closes #37