Explicitly blacklist unsafe elements, starting with `<script>`

Are there are any other elements that might be considered unsafe?
syncer freeze fix
plugin development with github and node.js
plugin development doc
Make more core strings be translateable

Now we’re translating strings that occur in JavaScript modules.

Partially fixing #491
Merge pull request #498 from buggyj/plugindocumentation

Plugin development with github
Merge pull request #496 from buggyj/syncer

syncer freeze fix