fix: sanitizer should not accept <!--> as a valid comment

According to http://validator.w3.org/ , <!--> is not a valid comment
and neither is any comment containing the -- substring.

I came across this possible issue while browsing the code for something unrelated. This makes the parser stricter, but I'm not sure that that's really desired. At any rate, I also added a unit test for comment parsing, as that was missing.