avoid bypassing xss protection

element.html() sets the raw value directly in the dom which seems to bypass the built-in $sce protection one would normally get with a built-in directive. This seems dangerous to promote as an example.