remove cgi.escape and simplify input sanitization

Escaping is done in Jade templates (by default).
new API response for like/dislike