We're already doing XSS cleaning, but in a couple of edge cases, we left
 leading and trailing spaces.  Also, there should never be HTML tags in
 section titles.
In both cases, this logic is on the server side.  It might be nice to
 surface this for the clients, and/or to use the validation library to
 add more constraints, but this is a step forward.

Our 'jquery.dataTables' library updates its internal state when
 `fnDeleteRow()` is called. That update ignores and overrides the last
 drag-and-drop operation.
This gives us two options: refresh the entire page (since the server has
 received the correct order), or remove sections _directly_, then call
 something else to update dataTables' state.  Here, we use option 2.