Security-relevant changes to HTML / template styleguide

:eyeglasses: @umbrae @ajacksified 

These guidelines should help folks avoid some common pitfalls and subtle errors with HTML templates