Can't use plain numbers as HTML attributes
Summary: The specific case where this came up was for tables: you can't say <td colspan=4>
-- it doesn't pass the whitelisting in BaseParsers.scala::xmlAttrVal
This is only High because you can work around it by putting quotes around the number.