Implement variable substitution instead of depending on lodash.template

[kbrabrand]

The lodash version uses eval under the hood, which is a problem on sites with content security policies that does not allow unsafe-eval. We don't want our users to be forced to enable it (for security reasons), so this is a better approach.