I love that Jas (being on the Google security team) just instinctively XSS's any form he fills out, and I love that our code just leaves his tag there, properly escaped, for all to see.