loofah: Loofah allowed_uri? treats javascript&#x3a alert(1) as safe · Teire