don’t clobber existing lead
whitespace fixup
add optional javascript injection protection