Amended json_escape comments

As it stands, the security of `json_escape` is a bit misleading. Clarifying that user-generated content must still be html_escaped if being inserted into the DOM via JQuery's html() method, since this is such a common use case.