then escape photoURL here, and put "src" in the "ignore" or "skipSanitization" (whatever it's called) array; maybe call it `srcHTML` so that we're consistent.