Escape output

When the output contains HTML special characters, such as '<' and '&', it can be interpreted as HTML, and so displays in an unexpected way. This happened to me as I added debug information to my spec. Some of the debug information was swallowed up, because it had those special characters in it. This PR adds a production-hardened html-escape function and uses it to escape the spec output in the view.

It is really unfortunate that JavaScript doesn't have something like this built-in, as it is a very common need. And Node.js doesn't provide anything out of the box either. Lessons go unlearned...