#111 revealed that we had experienced a regression of an earlier fix and that <script> tags could be injected by relying on the use of the uppercase Cyrillic i, as when Go lowercases this it would map the UTF-8 rune to an ASCII rune. The fix prevents this by retaining the ASCII escaping.