Fixing XSS pattern failing for "on" attribute. Previously didn't match onclick but did match "on" any a url. Unit test updated, as well.
Merge pull request #1 from travisred/master

Fixing XSS pattern failing for "on" attribute.