Input now scrubbed on the server-side