message: Allow span, and only allow style attrib
diff: @@ -92,11 +92,12 @@ var sanitizeHtmlParams = {
  // deliberately no h1/h2 to stop people shouting.
  'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
  'nl', 'li', 'b', 'i', 'u', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div',
  - 'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre'
  + 'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'span',
  ],
  allowedAttributes: {
  // custom ones first:
  font: ['color', 'style'], // custom to matrix
  + span: ['style'],
  a: ['href', 'name', 'target', 'rel'], // remote target: custom to matrix
  // We don't currently allow img itself by default, but this
  // would make sense if we did
  