0.27 updates - escapeHTML on response from server