Prevent XSS injection using 'nick' on presence

Also allows special characters in displayName. Fixes issue #182.