Mako safe-by-default

This is simply #4576 rebased onto the latest version of master.