enables html to be inserted into content editing but keeps xss script safe