Double down on XSS prevention. Attributes now require attr({ id:"foo" })