escape HTML in system notes instead of passing it through

Bug: 1014870
Change-Id: I7a72eac40667999b53d6cde4af5b5c62a4b7cacd