update(README): note about allowing html