add h (escape_html) helper method

yeah, probably a good idea to have this one
escape html from message

not a good idea to render content provided by evil users
Merge pull request #4 from johnyb/master

prevent evil scripting attacks