Added:
 - rejection of CSS unicode escaping
 - functions to purify styles can return null/None/'' to signify rejection
 - unicode '&#' escaping checked on all attribute values