specific test cases: http://ha.ckers.org/xss.html
expanded white-lists as mentioned in README