turn on autoescape for `flask.templating.render_template_string`