Use cssText instead of innerHTML to set theme styles.

src/ui/public/theme/theme.js

@@ -8,10 +8,18 @@ export function registerTheme(theme, styles) {
 export function applyTheme(newTheme) {
   currentTheme = newTheme;
 
-  // NOTE: The use of innerHTML opens up to XSS attacks, so we can't support user-generated themes
-  // as long as this implementation is in use. Ideally we would use the webpack style-loader/useable
-  // to activate and deactivate themes, but that causes the optimize step to fail.
-  document.getElementById('themeCss').innerHTML = themes[currentTheme];
+  const styleNode = document.getElementById('themeCss');
+
+  if (styleNode) {
+    const css = themes[currentTheme];
+
+    if (styleNode.styleSheet){
+      styleNode.styleSheet.cssText = css;
+    } else {
+      styleNode.appendChild(document.createTextNode(css));
+
+    }
+  }
 }
 
 export function getCurrentTheme() {