Sanitize stuff that comes in untrusted from URLs, use text() instead of html() unless we actually need html