xss_clean is not protecting GET requests that &item=/startwithslash

/webacd.do?isurlact=true&entactname=/webacd.do
becomes
/webacd.do?isurlact=true&entactname;=/webacd.do

This commit adds / to the regex to it will escape those GET requests

related to issue #3030