Make function output from locals autoescaped, keep macros safe

Continuing work from @andrewrk from gh-494

Slightly alternative approach, albeit, potentially crazy... Uses a `String` object to mark the actual string itself as `safe`. When the `escape` filter hits a `String` object, it checks if the input is `safe`. If it is, just returns the string value and continues on.
isString("") returns `false`. Is that the correct answer? Why is this more complicated than `typeof obj === 'string'`?