fix: sanitizer should not accept <!--> as a valid comment

According to http://validator.w3.org/ , <!--> is not a valid comment
and neither is any comment containing the -- substring.