As we don't have autoescaping working, these should be escaped. Same with issuer name below.