Simple whitelist-based html sanitizer