It's good that we've avoided POSTing HTML to the endpoint. Also etherpad-lite seems reliably safe from XSS issues, so it shouldn't be necessary to host etherpad content on a different domain.

We'll just need to ensure we consciously monitor security issues (since users have direct access to etherpad) and be careful of 3rd party plugins we bring in.