Wrap some things in htmlspecialchars

The account display name can't contain HTML tags, so this is no real
problem there. However, the 404 error message was an actual problem.