Should resolve cliftonc/calipso#259 by:
(1) - Escaping HTML entities using the OWASP best practices
(2) - Sanitize HTML and/or JavaScript content using the Google Caja library

* Escaping (1) is used on form fields of type text
* Sanitizing (2) is used on form field of type textarea

Here are links to the source code of the imported Google Caja files (no NPM module available):
https://code.google.com/p/google-caja/source/browse/trunk/src/com/google/caja/plugin/uri.js
https://code.google.com/p/google-caja/source/browse/trunk/src/com/google/caja/plugin/html-sanitizer.js
https://google-caja.googlecode.com/svn-history/r1950/trunk/src/com/google/caja/plugin/html4-defs.js

These files were very slightly modified by removing additions of the modules to the window namespace since the context is Node.js and not the browser.
The module were also exported so as to make them available through require()'s..

This commit creates an issue itself though by breaking <a> links.
The follow-up commit / pull-request will address this issue.