Replace validator's xss() with caja's sanitize()