Stop html_safe on user input

Fixes #59