okay I whitelisted h1-h6 tags here and immediately regretted it

(I also whitelisted em/strong, but I don't regret that)