HTML-escape a string constructed in Python