- fixed `<%=` usages in JS templates, replaced with `<%-`
 - translation caches are sanitized on build
 - removed `|raw` where not needed
 - enabled XSS checks in translations for XSS build