XSS protection + added the ability to create posts without tags

// cc @tadatuta @tormozz48 @gela-d 
should be `escape to protect` but it's kinda obvious