changed innerHTML to textContent to prevent XSS through twisted href values