Firstof tag should escape values by default.

This is introduced in Django 1.6, and should probably have been default behavior all along.
```
return escape(value)
```