I just turned off the ability for any non-admins to inject HTML in their Grumps.