Added `TODO: SCRUB` everywhere .html() input should be scrubbed.