Sanitize application header before inserting into DOM