rt @monowerker "escape by default in django was a fairly recent change, community persuaded core devs."