Make sure markdown doesn't allow users to insert arbitrary html

With these commits, we just escape HTML tags in the result text.

For example, if a user enters the comment:
```
<b>bold</b>
```

Then we'll display:
```
<p>&lt;b&gt;bold&lt;/b&gt;</p>
```

We could also just remove the HTML tags, or replace them by some text, if that's preferred.