forbid users to include HTML (default to on)