Fixed: (improved security) css can not have vars (ie user submitted content)