Escape inputs to graphs

Text inputs from the URL are not being escaped before use.
Replace string concatenation with escaped uTemplates to make
it harder to exploit.

Signed-off-by: Yan-Fa Li <yanfali@gmail.com>
uTemplate escaping for application.js

Use uTemplates to escape values before use

Signed-off-by: Yan-Fa Li <yanfali@gmail.com>
Use uTemplates where it makes sense

- escape some UI stuff, not strictly necessary but DRYer
- clean up some debug statements

Signed-off-by: Yan-Fa Li <yanfali@gmail.com>
Fix odd naming graphRouteTemplateId

- renamed to graphRouteIdTemplate

Signed-off-by: Yan-Fa Li <yanfali@gmail.com>