remove escaping href & src attributes
(since xss vulnerabity update)