Enforcing Model-View Separation in Template Engines