Xss bug fix

Addresses a number of issues exposed in #699 by adding HTML escapes.

In many cases I simply switch `<%= %>` to `<%- %>` in templates html [source](http://underscorejs.org/docs/underscore.html#section-141). This seemed to me the most straightforward way, and least likely to introduce weird behavior elsewhere.

In fixing the preview bug, I call `_.escape(content)` at the end of `compilePreview()`, and include a simple test at the end of `test/spec/views/file.js` to this effect.

I also call `_.escape` in `header.js` at the point where we render.

After incorporating these changes, I am able to navigate to the test repo in #699 without throwing alert messages left and right.

cc @mikemorris @anandthakker