fix candidate for reflected XSS vulnerability on webform confirmation pages.

A fix in two parts: 

When a confirmation message is rendered, the entire confirmation message body is passed through filter_xss_admin() once all webform and token module tokens are replaced.

 On the submission side, hook_webform_submission_presave() is implemented to filter webform submission values for XSS vectors before the submission is saved to the database.
Maybe? This should catch pre-existing values that may have already made their way into the db.