follow up to #280621 by lilou: the object tag was disallowed in a previous...

follow up to #280621 by lilou: the object tag was disallowed in a previous version in filter_xss_admin(), so disallow param as well, which is only meaningful inside an object tag