support html directly from quiz, but run through sanitizer