refactor allowed_token and unallowed_token as new methods in HTMLSanitizerMixin for usage in subclass.