XSS fix

Make Markdown output "lawful" by running it through htmLawed with
conservative settings.

The Markdown implementation used in Bolt does not currently provide a
"safe markdown" option, so we have to do the sanitizing on the Markdown
output. This is not perfect; most notably, links of the form <a
href="javascript:somethingdangerous"> are still possible; but at least
injecting arbitrary HTML is no longer possible.