Streaming HTML sanitizer