Wrap translatable strings with HTML in them in wp_kses()

See #231. For strings that have HTML in them, use `wp_kses()` to make sure only authorized HTML makes it through.