sanitize html input before rendering comments

because. ehm. xss.