Drop-In Chat had a few different XSS flaws. They should all be fixed now. Thanks for finding them and pointing them out!

Sorry for the slow security fix, I was traveling after leaving YC Hacks. Please do let me know if you find anything else wrong.