Hex-encode the msg querystring arg instead of url-encoding it.

This prevents Chrome from automatically detecting reflected XSS attacks
and blocking them. Not sure I really like this solution, but it works for now.