use pojo to separate ui and back-end, meanwhile us CDATA to disable
escape for DOM/Transformer