basic html renderer forces html safe