Users can no longer inject scripts into the client side.
I modified posts.py to do this. I just HTML escaped the message before
it gets converted to JSON