render_flash_messages() output must not be escaped