Improved solution to #318

The Jinja2 *automatic autoescape* has been enabled. Now the flask application adopts the Flask defaults and the Jinja2 environment is initialized  by the `flask.Flask` class. Now, any externally generated html must be declared explicitly as `safe` not to be escaped. This should help to make the Notebook more secure.

Does that solve any problem related to #319?

This changeset include non trivial changes and **should be tested intensively**. Several new bugs are expected.