s/escape_once/html_escape/, since html safety is the contract that now says whether something has to be escaped