Escape HTML for frame model

Fixes XSS vulnerability from #79