Escape HTML in usernames and message bodies to prevent XSS.
Merge pull request #13 from christhomson/xss-prevention

Escape HTML in usernames and message bodies to prevent XSS.