Remove potential XSS vulnerability

User-supplied content should not be marked as HTML-safe unless it's
been sanitized first.