Prevent code injection

Also, move preloaded data stringification out of index.jade and into synth