allowed html in popovers since we're escaping their input once already. Closes #27