Filter HTML to prevent XSS attack and don't hide buttons

This pull request solve two issues:

1.  https://github.com/fguillen/MDMagick/issues/4 : Buttons controls and preview don't hide when you use it.
2.  Filter HTML to prevent XSS attack: for example, when you write
```html
<script type="text/javascript">
alert ('security problem');
</script>
```
The alert don't be executed.