Response from my server looks like following:
[{\"coreGoalId\":1,\"title\":\"Core goal 1\",\"infrastructure\":\"Sample Infrastructure\",\"audience\":\"People
You would need
bypassSecurityTrustResourceUrl(html);
instead of
bypassSecurityTrustHtml(html);