make sure that bo-html sanitizes html

We were finding that if we used bo-html using html strings that contained scripts for example then those scripts would not be stripped as they would with ng-bind-html. 

I'm not sure if this change is something that can be smoothly merged or if there is some reason it is as it is. Particularly not sure if this works in the absence of ngSanitize module.