We should be rigorous about escaping this, though it might only be a problem in the preview window because the real apps load from external sources.