Firstof tag should escape values by default.

This is introduced in Django 1.6, and should probably have been default behavior all along.