Change template default filtering from dangerous to safe

This PR changes the default behavior of `edxmako` templates.

Here’s a list of cool things this patch does or allows:
* Introduces safe-by-default templates by HTML-encoding everything
* Fixes a lot of XSS vulnerabilities.
* Translation strings won’t have to include `&amp;` and other HTML entities in the future.
* Removes all ellipses from strings (causing accessibility issues).
* Probably more…

![image](https://cloud.githubusercontent.com/assets/166147/4831889/06d7fe54-5f98-11e4-9782-232764c515fd.png)

cc @nedbat
Fixed