Reject payloads with disallowed HTML

This builds upon #35, which will need to be merged first.
HTML should be capitalised.