fix protocol check in sanitization [CVE-2013-1857]
FIX: JDOM XXE Protection [CVE-2013-1856]
Fixes: CVE-2013-1855

fix incorrect ^$ usage leading to XSS in sanitize_css