Ensure attribute name safety

[stephannv]

Raises error when attribute name includes not allowed characters.

Now that Hash attributes are accepted, we should not permit attributes like:

a({ %(onclick="xss" class) => "btn" })

Without this protection the code above would render:

<a onclick="xss" class="btn"></a>