xssClean needs HTML context