add (now passing) test
use html.escape instead since apparently cgi is deprecated