sanitize markdown before rendering to prevent XSS

draw rainbox borders on element redraws in vdom method.
This lets us see what being redrawn, as the vdom.diff method
is breaking a few things.

www/md/main.js

@@ -22,6 +22,10 @@ define([
     var $textarea = $('textarea'),
         $target = $('#target');
 
+    Marked.setOptions({
+        sanitize: true
+    });
+
     var draw = function (content) {
         // draw stuff
         $target.html(Marked(content));