Add to docs that input will be HTML escaped

Change-Id: Ie90a6bc29f54361ec74cbf54551266b94ce6061f