Sanitize <script> tags and other malicious code on either client or srever

[tstone]

Look into how showdown.js handles this, and make sure that unsafe content isn't getting passed somehow.

[belaz]

the probleme lies near 'grafsOut.join' in showdown.js in _FormParagraphs.