Configure XSS filter to always treat input as raw HTML.
Improve filtering.
Add note about payload validation.
Abstract socket management into it's own module.

Fixes #2
Fixes #3