they technically already were, because of how and when they're unpacked. The project name is introduced well after DOMContentLoaded, so was technically already safe. The template name is even safer, there was no good reason for it to be sanitized at all since we already do a "does the template, by name, exist in the filesystem? if not, throw error". I think it accidentally got caught in a "better make all metadata safe" step.