Properly escape button content and document that safe html must be passed in

Change-Id: I0cfc99f5dca59134a327d74ee200b3ed22384191
Merge "Properly escape button content and document that safe html must be passed in"