Don't sanitize values for which the security context is not known yet; e.g. attributes instead of HTML element content.