drupal7 -- fix possible CSS

Drupal Security team reports:

Drupal core’s sanitization API fails to properly filter
cross-site scripting under certain circumstances.
Not all sites and users are affected, but configuration
changes to prevent the exploit might be impractical
and will vary between sites. Therefore, we recommend
all sites update to this release as soon as
possible.