This commit makes various changes to prevent servers from injecting
arbitrary JavaScript into the client. This prevents a variety of
possible exploits. The main changes in the client are as follows:
- Raw HTML from the server is now sanitised using caja to prevent
excution of JavaScript. See
https://code.google.com/p/google-caja/wiki/JsHtmlSanitizer
for details.
- The client now has a variety of CSS classes for possible chat
command messages that can be sent from the server, rather than the
server injecting arbitrary CSS `style` attributes into the client.
