adding target='_blank' as an allowed attribute