strip_harmful_tags: use XPath to actually get all tags to work on