This sidesteps tricky escaping issues, and will make it easier to build a strict Content-Security-Policy. Signed-off-by: Anders Kaseorg <anders@zulipchat.com>