Don't display author/body in html, but json_decode

Something like this, to fix #107?
I'm sorry, but didn't have time to set-up the vagrant file and/or test, so please do before using this.
Flags are based on this: http://stackoverflow.com/questions/12062146/is-json-encode-sufficient-xss-protection