Set json escape to true

[XhmikosR]

I think this shouldn't affect anything, but it's good practice IIRC.

From https://expressjs.com/en/api.html#app.settings.table:

Enable escaping JSON responses from the res.json, res.jsonp, and res.send APIs. This will escape the characters <, >, and & as Unicode escape sequences in JSON. The purpose of this it to assist with mitigating certain types of persistent XSS attacks when clients sniff responses for HTML.