new version of sanitize-html allows tag and/or attribute filtering to be shut off