Set default values for allowed html and iframesi #1056

This avoids errors if upgraders don't update config.php