Server side html cleanup

Now we can have a list of allowed tags!

It is possible to add something like <script>alert('Ops');</script> to the message. Using  |safe filter becomes dangerous. That patch makes server validation possible.

There are at least two ways to add <script> and bypass client side validation: to disable javascript in your browser or tamper request value. It's always required to validate user's data on server side.