We should probably be using .text() here rather than creating the html directly from the payload data, just in case a user decides to send a message like `<a onmouseover="stealAllYourData()">Click here for free upgrade!</a>`