Consolidated the list of disallowed characters in CSS/JS/URL contexts