Added:
 - rejection of CSS unicode escaping
 - functions to purify styles can return null/None/'' to signify rejection
 - unicode '&#' escaping checked on all attribute values
Merge pull request #9 from dcollien/master

Disallow some potential XSS vectors