Escaping HTML entities in message body before sending to client.

Prior to this commit, escaping was done when inserting into DB.