fix #1600, replace html_safe with more effective safe_concat