Only match evil HTML attributes on word boundaries

Prevents words containing (but not starting with) 'on' from being XSS filtered (see #201).