Manual free-text sanitisation

https://www.pivotaltracker.com/n/projects/887836/stories/74137504

This PR add validation that free-text fields in manuals don't contain dangerous HTML tags.
I'm not sure why the constant is in an initializer - it seems to add indirection. Another benefit to having it in the class is that it wouldn't be necessary to restart the server when experimenting with it in development.