Allow HTML markup in notes, auto-remove <script> tags