escape attrs before sending to client

fixes #232
cancel timer by erlang:cancel_timer/1

when it was started by erlang:send_after/3
Merge pull request #236 from esl/escape-attrs-bosh-ws

escape attrs before sending to client