html escaping for backbone/underscore