Prevent XSS injection using 'nick' tag on presence

Also allows special characters in displayName. Fixes issue #182.