Fixed the most obvious XSS vulnerability issues in WebBasket. Beware, in the message display, the "final_body" now gets fully escaped, which results in an impossibility to format messages in HTML. For a less-severe approach, only known vulnerable tags (such as PLAINTEXT, SCRIPT, etc) could be removed; or, even better, only pre-defined whitelisted tags (such as STRONG, EM, P, BR) could be allowed. Currently no HTML is interpreted at all.