Fixed XSS vulnerability in Admin Config

This fixes #60 by adding the Bleach 1.2.2 (and required html5lib-python 0.9.5) to the project; as well as a `bleach_filter` to `main/util.py` which will *only* allow a specific set (aka the whitelist) of tags and attributes in HTML sanitization. This is then used in the `filters` of the `Announcement HTML` field of the `Admin Config` form.

As-is, this PR might not satisfy the `gae-init` project standards... as the `main/util.py` received some constants for bleach that might be better located elsewhere. Feedback appreciated.