updated htmlawed to 1.1.16; allow passing htmlawed config to xss_clean()