delayed requires of nokogiri is insecure; do it upfront instead