<script> and <style> now use escape.html (stripping tags was incorrect form)