Closes #283 whitelist <script> attributes and noscript tag (when script posting is enabled)