fixup! rename embed_url to bare_url
Mark string as html safe