ensure all html content that's user-provided is escaped

e.g. JobScript, JobName, etc.

Most (all?) of it currently is, but I think that's by virtue of the syntax highlighting code, and might get lost if that's configured off.

Pull request #2 has some nice PIL code for converting to an image instead, but the copy/paste and grep-ability of text is really helpful, and it would be nice to keep package dependencies to a minimum.
