turn on autoescape for `flask.templating.render_template_string`

This seems like a sane default, since Flask turns on autoescape by default for html files when using the more common `render_template` so users will be expecting `render_template_string` to autoescape their template variables.