Ok, looks like `ng-bind` and `{{ }}` are the same and don't appear to allow HTML. `ng-bind-html` coupled with a sanitize call allows *some* safe HTML.