Rewrote string coloring to use a custom markup syntax:

* e.g. "{red|some red text}"
* the client is responsible for displaying it correctly
* removes the use of html, allowing the server to escape it properly
* fixes #18