Form error messages were not encoded when rendered

Error messages should be encoded as they may contain html.
CHtml::error() and CHtml::errorSummary() were outputting them as is