added a flag to disallow active content in attributes

predicated on `on...` attribute names.