the client should be responsible for not executing embedded JS in a message