don't add arbitrary text to innerHTML, use text nodes instead
Merge pull request #417 from Trott/de-xss

don't add plain text with innerHTML, use text nodes instead