escape HTML in client previews, not just server side