Use html/template instead of text/template.

This fixes all cross-site scripting issues.