Using .text() instead of .html() to disable script tag execution.

@10w042

We had some mildly undesirable behavior where script tags like `<script>alert('hi')` were being executed when they were pasted into the email box.  A merge would be great!