fix bug 863527 by updating text instead of parsing untrusted input

self.update() is safe, so create blank template, then set textContent, rather than setting the values prior to the template being parsed by insertAdjecentHTML.