add support for unescaped html expressions

Note that you should probably never use this feature. Using it will
almost certainly introduce XSS vulnerabilities into your app. Don’t say
I didn’t warn you.
update dep  version
0.1.3