These all seem to require html_safe/raw, so we'll permit it. Some of the spree code is a bit strange and could probably be improved, but I think it's ok for now.