Test for mark_safe() calls

Adds a check for mark_safe() calls to the calls_bad_names test, to identity
potential XSS vulnerabilities introduced by use of this Django function.
Updated TODO