Disallow links entirely in the application form

Turns out that it wasn't enough to just protect against the LR* bots; now I'm
getting tons of spam from other bots too. Let's just disallow all HTML links
(or at least, those that follow the typical "<a href=[...]>" pattern).