Another xss fix

Scrubber should scrub out out onload from addmessage.