safe html in editables tray

```
var washer = document.createElement('div');
washer.textContent = str;
return washer.innerHTML;
```
guaranteed browser-safe conversion instead of guessing which we need to wash.