Filter out m.room.aliases from the CS API to mitigate abuse while a better solution is specced.