fix #361 with rich OEmbed display via iframe, fix #237 by hiding sensitive content behind a spoiler on public pages