Change the way messages are sent/parsed

This just addresses a few minor things:

1) Before, the script was vulnerable to XSS. If you typed '<script>alert("hello world")</script>' as a message it would get executed. That is now fixed

2) The server sends JSON to the client containing the name/message instead of just a raw HTML string

3) Adds a 'chatters' event that sends the currently connected users