added a flag to disallow active content in attributes, predicated on on... attribute names
Merge pull request #430 from Pomax/disallowActiveContent

added a flag to disallow active content in attributes