Merge pull request #3 from lji/master

fix xss issue by using Safehtmlutil