Does AT have a way to escape variables? At the moment it's possible to inject HTML in todo titles.