Use 'sanitizer' module instead of 'validator' for XSS

Because `validator` dropped XSS Support in latest release:
https://github.com/chriso/node-validator/commit/2d5d6999541add350fb396ef02dc42ca3215049e

`sanitizer` is based on Google's Caja sanitizer, which is kept more up
to date.