This ensures we actually know when an AttributeError happens. It also changes most external code to use the correct environment, rather than simply creating a jinja2.Template, which wouldn't use the more tightened environment.