  from django.core.urlresolvers import NoReverseMatch, reverse
  from django.template import Context, loader
  from django.utils import six
  from django.utils.encoding import force_text, iri_to_uri
  from django.utils.html import escape, smart_urlquote
  from django.utils.safestring import SafeData, mark_safe
  
  from rest_framework.renderers import HTMLFormRenderer
  from rest_framework.utils.urls import replace_query_param
  
 
</s> remove     snippet = snippet.format(user=escape(user), href=logout_url, next=escape(request.path))
 </s> add     snippet = format_html(snippet, user=escape(user), href=logout_url, next=escape(request.path))
 </s> remove     snippet = snippet.format(href=login_url, next=escape(request.path))
 </s> add     snippet = format_html(snippet, href=login_url, next=escape(request.path))

from django.utils.html import escape, format_html, smart_urlquote
  from django.core.urlresolvers import NoReverseMatch, reverse
  from django.template import Context, loader
  from django.utils import six
  from django.utils.encoding import force_text, iri_to_uri
from django.utils.html import escape, format_html, smart_urlquote
  from django.utils.safestring import SafeData, mark_safe
  
  from rest_framework.renderers import HTMLFormRenderer
  from rest_framework.utils.urls import replace_query_param
  
keep keep keep keep replace keep keep keep keep keep
 Use format_html in tags that generate HTML 
rest_framework/templatetags/rest_framework.py