Allow custom sanitizing functions to be added to the XSS sniff

I've tested this and its working. See #144.