Security-relevant changes to HTML / template styleguide

These guidelines should help folks avoid some common pitfalls and subtle errors with HTML templates