Put the HTML attribute whitelist closer to HTML5