This is only thing which jumps out at me, but I think it's OK; @jennyd and I spoke about it at the time and couldn't see a cleaner solution. Anything which should have been escaped in that string should already have been escaped and so `.html_safe` won't turn it back to HTML.