WIP: at-mentions

TODO Security: Do you think this escaping is sufficient to prevent users from XSS-ing eachother? 
`self.body = self.body.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;")`

— DT