Missed a | html

HTML escaping really ought to be the default :-(
Saving a contact now works!