SECURITY: fix URI escaping when displaying 404

In one code path, the URI is passed without escaping into the 404
message.

bug: 48380
Change-Id: I561714be48da83e4252beaad03b27e32ce83cf7f