default HTML escaping behavior. Possibly pattern overkill, but if we add any other options later, this will scale nicely.