Make templates HTML-safe by default

Migrated from legacy PR https://github.com/CenterForOpenScience/osf/pull/1231.
Why was this removed?