Allow class and id attributes. Don't check img protocol