escape attrs before sending to client

for WS and BOSH clients