Use cleanInput() on incoming messages

This prevents XSS if one were to send messages using socket.io from the console.
Merge pull request #1545 from overra/patch-1

Use cleanInput() on incoming messages