Update validator => 3.17.x
Use _.template HTML escape