no cache attacks possible, static input (CSS)
limit HTML encoder span_for_kinds cache size