Use cleanInput() on incoming messages

This should prevent XSS if one were to send messages using socket.io from the console.

For example:
```js
var user = io('http://chat.socket.io');
user.emit('add user', '');
user.emit('new message', '<script>alert(1)</script>');
```