loofah: Loofah allowed_uri? treats data:text/html as safe text/plain · Teire