Run a html whitelist scrubber before saving to the database. 

We could make this an optional dependency, but it is safer and seems simple enough to be a default. Thoughts?