FIX: Use placeholder for avatar image size in expansion
FIX: remove invalid hack, correct whitelist to use value returned from callback
SECURITY: fix XSS in excerpt parser