CI_Security: Add 'form' and 'xlink:href' to evil attributes