is tidy closing tags client-side? I'd expect pump.io servers would need to be responsible for rejecting invalid html

(otherwise, there would be a security hole)