fix for renamed functions
perform more aggressive html sanitisation

switched to using a whitelist of elements and attrs