I notice you've removed the encode_entities, isn't it now XSSable? I'd probably make `append_css` do it to `$html`