Fixing XSS pattern failing for "on" attribute. Previously didn't match onclick but did match "on" any a url. Unit test updated, as well.