add HtmlPurifier plugin as submodule
use HtmlPurifier to avoid XSS