use HtmlPurifier to avoid XSS
change submodule to HTTP access