UI: temporary workaround for popupmenus v. XSS security