prevent XSS vulnerability in comments
closes #88