escape message body (XSS) fix #59