The tags you believe "they" don't allow can be configured - look at the AllowedTag parameter of the OACS Kernel.
To repeat: That is not my problem, and I understand about security but NEED to have forms there. Yes, I also understand how to create a page outside ETP and refer to this, but that's a very lame workaround - it HAS to work from within ETP.