force all string arguments to be converted to html-safe before use

use ERB::Util.h and add note to the README

Closes Issue #2
```ruby
def html_safe_options(hash)
  hash.inject({}) do |result, (key, value)|
    result[key] = ERB::Util.h(value)
    result
  end
end
```
`#each_with_object` would be even shorter, but is a bit less backwards compatible with older rubies.