json escape user string to prevent event spoofing. also a few small cleanups.
got very positive results from perf test while using blob urls.
fixed error handling in chat.lua; compiled sjcl with bytes codec; updated experiment in imghost
adding some discussion; wip