escape html in templates
add login link when logged out
use config, not translation