Fix encoding bug that broke HTML output after patching XSS vulnerability