serverside escaping for messages, usernames in spans