By default, web application web.configs have validateRequest="false". Changing it to true breaks SharePoint significantly, based on my own trials. People Pickers don't work, half the form pages don't work, etc.
This option, as I understand it, blocks any HTTP requests that contain any HTML. Which seems to be quite a lot of things in SharePoint.
Is there any work around to this? Or does SharePoint just not support this setting?