updated with gem 'rails-html-sanitizer'