First things first -- .html_safe is being called on a json object that ends up treating all attributes as html_safe, which means that any tags in these fields will get executed. Lets first use our json_escape method to get rid of anything trying to parse out data.

As for the ``` user: { :only => [:email, :first_name, :last_name, :username, :avatar_url, :gravatar_hash, :is_admin]} ```, we don't actually want to put in other users authentication_tokens. We probably should be doing something more akin to this (http://robots.thoughtbot.com/better-serialization-less-as-json), but for now this will work.