@alasdair defaults need to be secure. You can have custom theme which accepts HTML in fields if you understand the risks