it seems like every day we run into another situation where not having HTML encoded output by default in our views screws us over. sigh.