escape HTML by default