use HtmlPurifier to avoid XSS
change submodule to use HTTP access