do not render HTML input from participants. closes gh-510
for systems that allow a participant to create a new category or currency unit, use h() to escape. related to gh-510