Escape HTML where needed.
Factor out HTML escape code to bleach.js.
Add sanitizeURL tests.