Fixing Bug #8184
    - Posting of html only allowed if &allowhtml=`1` and eform field type is html
    - Prevent XSS by executing htmlspecialchars during formMerge