Reject payloads with disallowed HTML

This builds upon #35, which will need to be merged first.