A future version of the plugin API will defer any such escaping to the policy plugin so it can be configurable.
Includes unit test.