moved generic scripting out to khan-lite.js, use cgi.escape to be safe with message content