added several fixes against xss + unit tests

I've also added/extended some unit tests. One testcase remains failing, because i hadn't the time to fix it:

<p><img.src="javascript:alert(1)"</p>

this kind of attack works in some IE versions. In general javascript shouldn't be allowed in the url in safe mode.