more changes, almost kinda sorta works
1. add operator joining a room
2. avoid low-hanging xss
3. add call notifications for operators