prevent XSS in articles - towards #498