added test to ensure error detail gets html escaped