test case for injecting html into webform confirmation tokens.