force all string arguments to be converted to html-safe before use

use ERB::Util.h and add note to the README

Closes Issue #2