Make templates HTML-safe by default

Migrated from legacy PR https://github.com/CenterForOpenScience/osf/pull/1231.
Is is necessary to do both `json.dumps` *and* use the `json` filter?