Ensure all content is HTML escaped

Content coming out of Emoji is HTML and may contain images, ensure that all content we touch is escaped, whether or not we do emoji processing.
Bump version to 1.0.1