added html escape functionality from sinatra documentation