Sanitize html in preview

Fix #164, #161