Disallow some potential XSS vectors

- rejection of CSS unicode escaping
- functions to purify styles can return null/None/'' to signify rejection
- unicode '&#' escaping checked on all attribute values