0.36.0

• Security fix: for CVE-2021-42053 to prevent XSS attacks (reported by Jeffallan).

Breaking changes

• responses will be HTML encoded going forward (to explicitly opt-in to previous behavior use safe)