We now whitelist simple <div> and <span> elements

This is deliberately the camel's nose in the tent of whitelisting.  More
to come...