Remove <%== usage displaying settings

Using `<%==` is the same as using `raw`. I'm not sure if we meant
`sanitize` in this case, or it's just a typo. I'm assuming the latter
since we don't use anything similar in any other places.

spec/features/xss_spec.rb

@@ -60,6 +60,16 @@ describe "Cross-Site Scripting protection", :js do
     expect(page.text).not_to be_empty
   end
 
+  scenario "poll description setting in dashboard" do
+    Setting["proposals.poll_description"] = attack_code
+    proposal = create(:proposal)
+
+    login_as(proposal.author)
+    visit proposal_dashboard_polls_path(proposal)
+
+    expect(page.text).not_to be_empty
+  end
+
   scenario "annotation context" do
     annotation = create(:legislation_annotation)
     annotation.update_column(:context, attack_code)