Feature Request: Allow whitelisting of HTML tags as a server configuration

[jason-s]

https://github.com/jupyter/notebook/blob/master/notebook/static/base/js/security.js#L79

Looks like HTML tags are sanitized regardless of whether a notebook is trusted or not.

I run jupyter on my local machine and it is a private instance. I want to whitelist <iframe> and <object> tags so I can display external HTML files and SVG images (with external CSS stylesheets). Can't do it right now without monkeypatching security.js; it would be nice to make this a configurable option.

for example: https://github.com/google/caja/wiki/CajaWhitelists