Fixed vulenarability in default config of html cleaner (javascript: and data: was passed without filtering in href attribute of <a> tag (http://habrahabr.ru/post/164539/)