display_name field of a user is HTML escaped. See here for example.
Is this expected behavior or a bug? The documentation doesn't mention it.
It's mentioned under the Safety section of the filters documentation that by default all response data can be safely inserted into HTML, which is why the data is pre-escaped in this case. You can try creating an unsafe filter using the