fixing html cleaner
SESSION_COOKIE_HTTPONLY activated by default
fixing cleaner, using fromstring instead of fragment_fromstring
escaping html tag attrs in underscore everywhere