Revert "Fix XSS vulnerability that's not really XSS

This reverts commit 5d12c4b68c95935dde2984b1d4da222a409b31f3, and
implements it at output, not in the logic.