partial fix #2667

this fixes the ability to replace a space with a /
and skip the XSS filtering

specifically this :

        <div/style=content:url(data:image/svg+xml);visibility:visible onmouseover=confirm(1)>Bring-Mouse-Over-Me</div>

would allow a potential XSS site