sanitize HTML in backend errors