escape all HTML by default