just print failures in XSS test
Allow nulls in html tag names, since some browsers apparently did
Fix special case-insentive compare with nulls, remove debug