var declaration cleanup including a bugfix (len was undefined)
for now, disabling "extremely configurable" tooltip, need to make this UX better.
XSS vulnerability fix - thank you to Jordan Milne (/u/largenocream) for the responsible discovery and contribution of a patch.