Add some docs about admin-side HTML sanitisation