Close #245 + fix security issue added with annotation text in header. Use escaping!