Added third parameter to render() whether to use autoEscape