Only allow numeric entity reference with a value greater than 8. I don't know where in html they're used, but their presence kept the javascript url sanitization tests from passing.