update tests to expect render_template_string to autoescape variables