Update XML sanitizer method to allow more legal characters.
Fixes #297.
Added source in the comment.