by Tim Hunt.
Teachers are allowed to insert <javascript> and other dangerous stuff when they are editing teacher-only places like labels and quiz questions.
This is, of course, a security compromise, but a necessary one, becuase there are some valid editcational things that you can do if you can paste a script into these places.