Mention auth in /api/mod/update
Escape inline HTML