I would turn off filtering here; if someone enters a URL with a querystring, Htmlawed might encode the `&` in the string. Otherwise this looks ready