Escape HTML entities

This PR addresses the security of saved content.  When users, conversations, posts, groups are created or saved, we currently don't escape special characters.    With posts, especially, this can cause unwanted behavior.  For example, posting:

`Be the change you <b>want</b> to see...` would appear as: 'Be the change you **want** to see...'.

In this case, bolding letters is pretty benign.  But what if some user posted:
`Be the change you want to see. <script>window.location='google.com'</script>` ?

This would effectively redirect your browser to google.com whenever you loaded the comment.  In order to prevent things like arbitrary script tags from being executed, we can replace things like `<` and `>` with their HTML entities.

This PR adds an .escape() utility method which gets called whenever something is created or saved.  In addition, the client side code has been updated to use .innerText in addition to jQuery's .append(), as the latter will add the provided string as HTML.
I just want to clarify the thought process of these two lines of code to make sure that I understand them. The `hasOwnProperty()` method allows us to isolate the properties of `dirtyObj` that aren't inherited from another object (let's call these properties 'immediate properties'). Is the thought process behind using `hasOwnProperty()` that we'll be sanitizing only the immediate properties of `dirtyObj` and not filtering through the inherited properties (since attributes like `req.body.id` and `req.body.username` will be immediate properties of `dirtyObj` and those are the only properties that we really want to sanitize)?