Fix html_safe_string_class

My last patch broke the `html_safe_string_class` functionality, I'm very sorry :cry:

What was happening is that we were only creating an instance of `html_safe_string_class` when no escaping needed to be performed on the string. If escaping needed to be performed, a regular `String` would be returned. This wans't caught by the tests because they were only testing the simple case where no escaping needed to be performed on the passed string.