don't sanitize basic attributes for a and img