Replace validator's xss() with caja's sanitize()

issue #1378