Escape HTML characters in variable strings.

The variable replacer callback now escapes dangerous characters by default. To bypass this a ampersand flag can be passed inside the opening curly bracket like `{&wont.be.escaped}`. While I was modifying the regex for variable replacement in strings, I also added the option for templates to provide space characters inside the curly brackets so `{arg}` and `{ arg }` behave the same.