use sanitized note content to create DOM nodes

avoid innerHTML…