Parse html against parser rules by default when calling get/setValue

I introduced a possible security flaw in a product in developement where I forgot to explicitly say to sanitise the input against the parser rules when calling `setValue`. It seems like the safe default is to sanitise the input unless the developer says not to and what most people would expect. In particular, the [security section of the documentation](https://github.com/edicy/wysihtml5/wiki/Security) says that bad tags are stripped out but currently this only applies if you know/remember to pass an extra true parameter `getValue`/`setValue` functions. This PR sets the opposite to be true; html is parsed by default but you can disable it if you need to.