We were confused about what `.html_safe` did, and were automatically marking as safe content which was not.
html_safe