Sanitize output well, but entity-ize < and > in notes

Coming from a rich message or API call, notes can contain HTML and it
will render to the browser. Coming from a normal todo creation, though,
all < and > characters will be replaced with the corresponding entities.
This preserves HTML emails, but prevents users from breaking the layout
by entering broken HTML for todo notes.

Closes #765

app/helpers/application_helper.rb

@@ -202,11 +202,15 @@ module ApplicationHelper
   end
 
   def format_note(note)
-    note.gsub!(/</, '&lt;') # eliminate tags
-    note.gsub!(/>/, '&gt;')
     note = markdown(note)
     note = auto_link_message(note)
     note = auto_link(note)
+
+    # add onenote and message protocols
+    Sanitize::Config::RELAXED[:protocols]['a']['href'] << 'onenote'
+    Sanitize::Config::RELAXED[:protocols]['a']['href'] << 'message'
+
+    note = Sanitize.clean(note, Sanitize::Config::RELAXED)
     return note
   end
 end