When doing HTML sanitization, I always whitelist marquee as an easter egg (and almost nothing else)