I removed the escaping because `get_url` is this:
```python
def get_url(self):
    return "https://twitter.com/" + self.user_info['screen_name']
```
and I'm pretty sure we can expect Twitter to provide an HTML-safe username, since they only allow alphanumeric characters (+ underscore).

My other motivation was that there are plenty of places where we don't currently escape this data. If this approach is vulnerable, then we were already vulnerable.