Use ERB::Util to HTML and URL escape everything

Tested-by: Mark Somerville <mark@crocodile.is> [Arch, MRI 2.1.1]
Signed-off-by: Mark Somerville <mark@crocodile.is>
Gemfile: add :development group & install command

Tested-by: Mark Somerville <mark@crocodile.is> [Arch, MRI 2.1.1]
Signed-off-by: Mark Somerville <mark@crocodile.is>