initial commit
use Redis pub/sub to scale beyond 1 process
use wss:// in production
prevent HTML/JS injection attacks