use escape-html module to escape html

Another util bites the dust.