I'm not sure why we weren't using the escaping tags. It might've been a security hole if not for the auth-server's vicious validation of inputs.