refactor allowed_token and disallowed_token as new methods in HTMLSanitizerMixin for usage in subclass.