flash content is unsafe by default.

Use response.render.SafeString() to mark the content as safe HTML.