fixed draw new chat mess that allowed html injections