Update tests for `html_escape` policy

The policy is only applied if we are actually in an encrypted context