This is prone to XSS since the content-type is set to `text/html` and the output isn't sanitised.