use sanitize to deal with sandboxed user-input
add rel="nofollow" for user input urls in links and img
carefully deal with \img attrs
make autolink list configurable