Fixing XSS pattern failing for "on" attribute.

 Previously didn't match onclick but did match "on" any a url. Unit test updated, as well.