I'm relying on upstream validation and escaping, which is probably a bad idea. I'll add explicit html escaping.