Filtering improvements

The intervening code allows XSS to slip thru. It needs to be the final thing called. I left the previous call so that SliceString doesn't choke on partial HTML.