__str__ must return str so can not return safe str

morever, format_html is recommanded by the doc for that usage.
fix encoding problem
add favicon