Should still be sanitizing user input, there's no reason to be passing the message as an html variable in handlebars {{{message}}} :/

You trust your server-side sanitization that much?