added xss filter to chat messages