No HTML string can start with "#", avoids XSS. Close gh-36.