htmlpurifier off by default