Fix style attributes not being sanitized unless <style> elements were also whitelisted.
Convert config arrays to sets at runtime to allow nicer config syntax.
Add docs for CSS sanitization.
Add docs for CSS sanitization.
Add a benchmark disclaimer.
Fix malicious expression injection using a carefully placed comment.

This sanitizes the expression from a maliciously crafted property value
such as `width: expr/**/ession(...)`.

Crass correctly parses this value into multiple tokens since the comment
breaks up what would otherwise become a single :function token, so we now
combine the values of :ident tokens until we hit a :function token, then verify
that the combined value isn't an expression.
Add some lovely new tests for malicious HTML and CSS.