escape xml in getSuggestions()
show ␣ in suggestions which start or end with a whitespace
sanitize any strings passed to setText, even translations (using nsIParserUtils, as requested by add-on reviewer)