Sanitize the string tag passed to DOM components

Because we're using innerHTML to generate DOM Elements, we need to make sure that the tag is sane and doesn't try to do injection.

This wouldn't be an issue if we used document.createElement instead.
I was trying to cheat to safe some micro-perf but you're right. We could stick to a subset but never allow invalid tag characters. (such as starting with `:` or `<`)

Thanks for the sanity check.