html-escape everything on client