slightly less sanitization, which we can do due to post-DOMContentLoaded buildup