[multiple, fix] using safestr in web.form.Dropdown._render_option