package.json: add escape-html