def escape_opaque_token(xml):
    """
    Escape raw token xml to put it in form field.

    The RealMe Java backend use this function to escape:

        org.apache.commons.lang.StringEscapeUtils.escapeHtml

    which will escape quote, while most Python libraries don't do this by default.
    So the `quote=True` arg is important.
    """
    from html import escape
    return escape(xml, quote=True)
