Escape <, > and & in HTML

Also adds <html> and other boilerplate tags.

I've not included an updated index.html.