substate marked-react

Test plan: added some javascript: links; checked they were sanitized to #