XSS cleaning, final draft.

I've tested this, and it seems to work well!

I also tried hacking some var_dump() calls into the bootstrap, and I can see how the raw and clean values are populated for various get queries (e.g. "index.php?foo|bar=hello_w\<o\>rld" gives "foo_bar=hello_w\<o\>rld" as raw and "foo_bar=hello_wrld" as clean).

Pending your feedback, I think it's ready to pull...