disallow html in notes