Error reporting #security

Exception message markup should escape messages. I don’t see how it can be exploited, but it’s something good to do on the next merge.