Much safer annotations.

By default *disallow* html injection.