Sanitize user generated info before html_safe

Supports #187