Switched ^ to \A and $ to \z in sanitize_css.

Making sure bad people can't sneak in a newline in their CSS.
See here for more info: http://guides.rubyonrails.org/security.html#regular-expressions.