what about "escape" as option for the FlashComponent? So for normal text (non HTML) it should properly escape the flash message content to avoid XSS or HTML breakage with chars like `<` or `>` etc.
It could default to true as most texts passed are pure text, but when using HTML one can set it to false then.