Since this setting is designed to inject arbitrary HTML, shouldn't we add `|safe` to disable autoescaping?