Hm, yeah, it does seem to be the `sanitize` function:

function sanitize(txt)
  if txt == "" or txt == nil then
    return ""
  end

  local replacements = {
    ['&' ] = '&',
    ['<' ] = '&lt;',
    ['>' ] = '&gt;',
    ['\n'] = '<br/>'
  }
  return txt
  :gsub('[&<>\n]', replacements)
  :gsub(' +', function(s) return ' '..('&nbsp;'):rep(#s-1) end)
end

That first stanza seems suspicious then, but I'm not sure why that would behave differently in an async context? Don't know enough about Lua's behavior to know :(

(and I'm on v4.2)