We'd have to think about security constraints but
actually I can't see any ATM.
When Ian talks about security constraints, he's referring to XSS
attacks. We did a lot of work (actually, IAN did a lot of work :)
cleaning up the UI for this. For example, we want to avoid having things
like this show up in the UI in an HTML context:
<script type="text/javascript">
document.write('<b>Hello World</b>');
</script>
So, that's what is being referred to when "security" issues are being
referred to here.