Check how we're rendering blocks to prevent XSS, other issues

So while most of the time we're alright as far as security goes thanks
to the built in escaping, we can run into issues where a block is
rendered in one context (say, a block of html), and is then is written
out to another context like inside a script tag. HTML doesn't have the
same rules for escaping as Javascript.