server-side sanitising, some voting and displayname fixes