backed out changes to _webform_filter_values(). This removes XSS protections on webform token replacement on confirmation pages.