prevent &nbsp; insertion, closes #112
limit request size, closes #107
fix order of converting HTML back to text

Fixes a regression introduced by ad9384e, which escapes wanted line
breaks, such as <br /> and <div>.