Use the MathJax `Safe.js` extension to prevent XSS

services/web/public/coffee/directives/mathjax.coffee

@@ -2,6 +2,7 @@ define [
 	"base"
 ], (App) ->
 	mathjaxConfig =
+		extensions: ["Safe.js"]
 		messageStyle: "none"
 		imageFont:null
 		"HTML-CSS": { availableFonts: ["TeX"] },