Implement output encoding via Smarty to minimize cross site scripting

We should encode all output to prevent various scripting attacks:

http://acko.net/blog/safe-string-theory-for-the-web

drupal uses this quite successfully and we can borrow code from it. Please document the exact files AND version if we do copy code from drupal