fix bug 821986: Strip out attributes starting with "on" from Document content before rendering editor

This seemed easy... too easy. Adding another filter to strip "on" attributes was pretty simple, and should be pretty easy to add new filtering logic if/when further CKEditor vulnerabilities can be solved that way.

I was worried about the filtering on edit thing, but it turns out we've been filtering in the RevisionForm the whole time already. :neckbeard: