xss hazard. Just make this one of the transforms in linkify.