make sure that bo-html sanitizes html