add highlighting

no styling yet, but search highlights are now being passed through the ajax call.
we're not scared of sql injections!