add HtmlPurifier plugin as submodule
use HtmlPurifier to avoid XSS
change submodule to use HTTP access
Add permission check for HtmlPurifier
Merge branch 'master' into debian
update changelog