status-page: escape html, move script to body