change sanitizeURL to sanitizeAttrs with the option to sanitize urls
new NYTimes templates escaped to be consistent for AMO reviewer
sanitizeAttrs instead of escapeHTML for html attributes