Escape HTML in usernames and message bodies to prevent XSS.

I added a (pretty lame) method for escaping HTML tags. Without this, if someone says something like `<script>alert('wat')</script>` in a logged chatroom, that script can be executed on the log page.