Added "allow_html" check to XSS rule