Display safe HTML+SVG even if untrusted, but don't set trusted=1.