add 'target' attribute to <a> whitelist