Escape HTML entities

This PR addresses the security of saved content.  When users, conversations, posts, groups are created or saved, we currently don't escape special characters.    With posts, especially, this can cause unwanted behavior.  For example, posting:

`Be the change you <b>want</b> to see...` would appear as: 'Be the change you **want** to see...'.

In this case, bolding letters is pretty benign.  But what if some user posted:
`Be the change you want to see. <script>window.location='google.com'</script>` ?

This would effectively redirect your browser to google.com whenever you loaded the comment.  In order to prevent things like arbitrary script tags from being executed, we can replace things like `<` and `>` with their HTML entities.

This PR adds an .escape() utility method which gets called whenever something is created or saved.  In addition, the client side code has been updated to use .innerText in addition to jQuery's .append(), as the latter will add the provided string as HTML.
Yeah, I agree. It's probably best to limit the scope of this function's influence to just the properties that we want to validate (`username`, `id`, etc.).