change default to xss=on, option=recommended

lib/models/config.js

@@ -102,7 +102,7 @@ module.exports = function(crowi) {
 
   function getDefaultMarkdownConfigs() {
     return {
-      'markdown:xss:isPrevented': false,
+      'markdown:xss:isPrevented': true,
       'markdown:xss:option': 2,
       'markdown:xss:tagWhiteList': [],
       'markdown:xss:attrWhiteList': [],