renderers: escape contents of API return values
This is not the most beautiful of hacks, but at least it seems to play well with our URLization.
Close T640.