@jamalex please hold off on this. cgi.escape is not the right solution, the way I've used it.  We need to allow HTML to be passed in these strings, and what I've done destroys that.

At the same time, the safe filter did not stop <script> tags from being passed to the client (despite never being marked as safe).

I'm not sure what the right solution is yet, but ... it's not here yet.  The current code will break our HTML-using messages (despite them being marked as safe).  Will look at this after returning from HTH