Cache: prevent code injection (on top of XSS) + ability to execute HMVC or Forge a view within the cache