Sanitize HTML

.. :-(
(I can't stop mentioning how important it is to sanitize EVERYTHING)

\cc @karlitschek @schiesbn