escape html in messages

allow simple formatting later