load langs from disk

production doesn't trust globalsign root ca.
also, that data is served unescaped. avoid potential script injection.