fixed the XSS security issue. Added a new element (textarea_html) which is available just for users with unfiltered_html capability