html_safe
added (possibly) missing stuff to locales/en/requests
escape HTML in page_notice's :message / :title / :from