Annotations: added html sanitation to prevent markup injection/XSS, Closes #1121