Enforce more strict handling for html escaping

Always escape even if all current sources are escaped.
Do it without double escaping.