Reject payloads with disallowed HTML

This builds upon #35, which will need to be merged first.
Aha! We can solve this using inflections:
```ruby
ActiveSupport::Inflector.inflections do |inflect|
  inflect.acronym 'HTML'
end
```