Add XHTML to the whitelist.

Fixes #46.