fix XSS vulnerability with conversation titles. closes #122