Do not treat flash as html_safe. Do not manually escape attributes in talk/list/user/document.