Revert "Sanitize generated HTML to prevent XSS attacks."

This reverts commit 9c3d04e817a34cf1b1a9f5492c4c68cfd0cb83f7.

It turns out that the sanitizer is a bit overzealous:
it removes _all_ URIs, including images and hyperlinks.

I'll investigate how to tone it down (or maybe different users
get different sanitizer policy), and I need to figure out how
to get it on the preview page (which is client side).