add HtmlPurifier plugin as submodule
use HtmlPurifier to avoid XSS
change submodule to use HTTP access