CKeditor configuration does not support disallowed content

Currently, CKeditor is invoked with the parameter "allowedContent: true" in civicrm/js/wysiwyg/crm.ckeditor.js.

As a result, custom CKeditor configuration files, such as those which can be specified with a hook as described in https://wiki.civicrm.org/confluence/display/CRMDOC/hook_civicrm_coreResourceList, are unable to specify a disallowedContent parameter. This is because:

• dissallowedContent is ignored if alowedContent == true.
• In-line parameters such as allowedContent which are specified in the invocation of CKeditor cannot be overridden by a configuration file.

To allow users to specify dissallowedContent, I suggest that allowedContent not be specified in-line. Options include:

• Leave it unspecified (the default is null) in which case the user-specified toolbar items would determine the allowedContent.
• Set it to true in the config file generated by the web page "Configure CKEditor".

Another simple but useful improvement (while we're talking about it) would be for the "Configure CKEditor" web page to allow the user to specify a value for CKeditor's customConfig parameter which would appear in the machine-generated config file. Note that each time CKeditor finds a customConfig parameter in a config file, it subsequently loads that specified file, overriding previous values. This scheme has the advantages of:

• Allowing the use of the "Configure CKEditor" web page to be used to specify toolbars, etc., while simultaneously allowing a user-generated config file for additional features like disallowedContent.
• Eliminating the risk of losing any customizations made to the machine-generated config file if the "Configure CKEditor" web page is inadvertently revisited.
• Eliminating the need to use a hook to specify a custom config file.

Reference:
http://docs.ckeditor.com/#!/api/CKEDITOR.config-cfg-allowedContent
http://docs.ckeditor.com/#!/guide/dev_configuration-section-configuration-loading-order