Roundcube Webmail: three more sanitizer bypasses enable tracking and phishing

I got bored so I decided to take another look at Roundcube :)