Should resolve cliftonc/calipso#259 by:
(1) - Escaping HTML entities using the OWASP best practices
(2) - Sanitize HTML and/or JavaScript content using the Google Caja library

* Escaping (1) is used on form fields of type text
* Sanitizing (2) is used on form field of type textarea

Here are links to the source code of the imported Google Caja files (no NPM module available):
https://code.google.com/p/google-caja/source/browse/trunk/src/com/google/caja/plugin/uri.js
https://code.google.com/p/google-caja/source/browse/trunk/src/com/google/caja/plugin/html-sanitizer.js
https://google-caja.googlecode.com/svn-history/r1950/trunk/src/com/google/caja/plugin/html4-defs.js

These files were very slightly modified by removing additions of the modules to the window namespace since the context is Node.js and not the browser.
The module were also exported so as to make them available through require()'s..

This commit creates an issue itself though by breaking <a> links.
The follow-up commit / pull-request will address this issue.
Should resolve the issues related to the <a> links created by pull request : cliftonc/calipso/pull#261. Changes:
(1) - Dirty hack inside the link template rendering method that URI encodes parameters
(2) - Replacing every mention of a verbose field (username, author, ...etc.) by it's URI-encoded copy
(3) - Replacing every concatenation of variables to create URIs for HTTP redirects (res.redirect()) by their URI-encoded version

Together (1), (2) and (3) solve the issue raised in pull request #261 where <a> links were broken.
A quicker and cleaner way to fix this issue would be to create two hooks one as a middleware / prototype of Express.js's res.redirect() where the URI is encoded. The other hook would be called when creating <a> links when rendering templates so that every href is URI encoded.
Removed debugging console.logs.
Merge pull request #261 from Mickael-van-der-Beek/master

Should resolve some of the security issues. Will check this out.