update OWASP HTML Sanitizer to r223 (closes #3); more idiomatic