Prevent XSS where unsafe content is served inline on the application origin.

Follows up on #34477. References 06ab7b27 and d40284b1.