Turn on autoescaping in jinja templates

[chrisbay]

turning jinja2's autoescape mode on would solve a common problem. Many people were doing something like <p>{{movie.owner}} watched ...</p>. Because movie.owner is an instance of User, it prints out something like <User .. >.

The browser parses that as an html entity, so it doesn't display anything (unless you click view-source). It would be much easier for students to see what was going on if it printed out <User ..>. Plus, it's good practice to have autoescape on anyway.