Update templates so that html & js cannot be ran from user, message, or chat room