BACKWARDS-INCOMPATIBLE: turn on template autoescaping by default.

Disable autoescaping in demos that don't already use it.

demos/appengine/blog.py

@@ -151,6 +151,7 @@ settings = {
     "template_path": os.path.join(os.path.dirname(__file__), "templates"),
     "ui_modules": {"Entry": EntryModule},
     "xsrf_cookies": True,
+    "autoescape": None,
 }
 application = tornado.wsgi.WSGIApplication([
     (r"/", HomeHandler),

demos/blog/blog.py

@@ -53,6 +53,7 @@ class Application(tornado.web.Application):
             xsrf_cookies=True,
             cookie_secret="11oETzKXQAGaYdkL5gEmGeJJFuYh7EQnp2XdTP1o/Vo=",
             login_url="/auth/login",
+            autoescape=None,
         )
         tornado.web.Application.__init__(self, handlers, **settings)
 

demos/facebook/facebook.py

@@ -46,8 +46,9 @@ class Application(tornado.web.Application):
             xsrf_cookies=True,
             facebook_api_key=options.facebook_api_key,
             facebook_secret=options.facebook_secret,
-            ui_modules= {"Post": PostModule},
+            ui_modules={"Post": PostModule},
             debug=True,
+            autoescape=None,
         )
         tornado.web.Application.__init__(self, handlers, **settings)
 

demos/websocket/chatdemo.py

@@ -43,6 +43,7 @@ class Application(tornado.web.Application):
             template_path=os.path.join(os.path.dirname(__file__), "templates"),
             static_path=os.path.join(os.path.dirname(__file__), "static"),
             xsrf_cookies=True,
+            autoescape=None,
         )
         tornado.web.Application.__init__(self, handlers, **settings)
 

tornado/template.py

@@ -90,7 +90,7 @@ import re
 from tornado import escape
 from tornado.util import bytes_type
 
-_DEFAULT_AUTOESCAPE = None
+_DEFAULT_AUTOESCAPE = "xhtml_escape"
 _UNSET = object()
 
 class Template(object):