StringEscapeUtils.unescapeHtml: handle HTML escapes without semicolon

org.apache.commons.lang.StringEscapeUtils.unescapeHtml is useful in detecting and correcting Cross-Site Scripting (XSS) attempts by converting escaped chars like &# 60; or & lt; (remove spaces) into normal chars like < so patterns like HTML tags can be detected. Many browsers will allow variations without semicolons, particularly the long UTF-8 encoding like &#0000060. Please see: http://ha.ckers.org/xss.html

Since this may not be standard HTML, maybe adding a boolean bLenient parameter to the method could allow better backward compatibility.