Escape HTML in response before inserting into DOM
Fixes #33