Factor out HTML escape code to bleach.js.
Add sanitizeURL tests.