escape-html user submitted text.

Escape the html the (may) be in user-submitted text before sending it in
a response.