Use html/template, not text/template

[echlebek]

We should be using the html/template package, not text/template, for working with templated HTML. The html/template package sanitizes its inputs.

This is a security issue; without html/template, malicious input can be injected into the email message.

See https://golang.org/pkg/html/template/

[hurrycaine]

There is some benefit of using text/template, like controlling white space when the body (or subject) is plain text. I can see this being really helpful on the subject, where you could have complex conditionals but every square inch is important.

Example from the docs.

For instance, when executing the template whose source is

"{{23 -}} < {{- 45}}"
the generated output would be

"23<45"

This also could be a breaking change if someone used html and used {{23 -}}. In HTML all extra white space becomes one, so it really is not needed. However, it will fail if left in with this change.