The code is removed even when wrapped in
<code> tags. Wouldnt adding script/style to extended_valid_elements pose a security issue?