Most things were already escaped, including the json.dumps, and we've
decided not to use dump_html_escaped_json