Will assume for now that card text does not include malicious scripts; adding directly as HTML to get HTML entities working without workarounds.
Controllers shows candidates when all players are finished.