XSS: don't render HTML strings