trust in our html sanitize function (closes #119)