sanitize_hex_color doesnt work at all...
revert to esc_attr