fix incorrect ^$ usage leading to XSS in sanitize_css
fix protocol checking in sanitization [CVE-2013-1857]