The problem I have with using `.html()` in situations where we could get by with `.text()` is that the content we are passing to `.html()` today may be safe. But over time, things can creep in-the part of the code creating the content is usually far from the actual call to `.html()`. I think we should be very aggressive about removing uses of html and all remaining ones should have:

1) A comment about why the content is absolutely always safe....or
2) A call to `is_safe` to verify the content is in fact safe.