add one last (I think) string sanitization pass that just tries to
replace every non-space character with 'x'