JS injection fix (does HTML::element() no longer do this fully?)

Change-Id: I6de47dac7132d508cd47cb0b11e07404ac9be0e0