in method calls like <%= blah(cookies[:snickerdoodle]) %>

(It could happen, I guess)

when they are given user input

Previously, only append= and safe_append= were being
processed, but everything else was ignored. Turns out
there are more methods, though, so just process
everything.

in particular looking in calls to raw()

when looking for immediate output

and using Erubis

because apparently that happens a lot

to be less assertive

because ERB adds an encoding comment