escape_html should always return string, add missing to_s