Use escaping by default in views

While here, remove String#html_safe and the places where it was
used.  And use the render_each plugin to simplify some code.