added a flag to disallow active content in attributes, predicated on on... attribute names