There was a bug where data passed to content_for via a string and not a block
was being marked as "html safe" when it hadn't been escaped.
Change-Id: I679281d1a767841b8f4d90ebbb8f8ca61a2a07f4
Reviewed-on: https://gerrit.instructure.com/2374
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>