Prevent servers from injecting JavaScript into client

This commit makes various changes to prevent servers from injecting
arbitrary JavaScript into the client. This prevents a variety of
possible exploits. The main changes in the client are as follows:

- Raw HTML from the server is now sanitised using caja to prevent
  excution of JavaScript. See
    https://code.google.com/p/google-caja/wiki/JsHtmlSanitizer
  for details.

- The client now has a variety of CSS classes for possible chat
  command messages that can be sent from the server, rather than the
  server injecting arbitrary CSS `style` attributes into the client.