Why are we `html_safe`ing the `entry.name`?  That doesn't seem secure.