The problem is html within the chapter data. It's entirely too easy to inject malicious code via an html upload. That's why it's not allowed. As to the javascript, why disable it? It's only used here for menuing, primarily, and is part of the rich text editor as well.