add XSS protection to not allow HTML

Disable all possible HTML injection via email notification.
The problematic fields are only the ones that the user supplied.
#PLAT-1555 #time 3h