Html: Reject </script> from inlineScript() and leave rest unescaped