Moved the "unknown_mode" handler to the base-class.

  THis is where it belongs since it is a generic method.

  Also escape the unknown mode, to avoid XSS:

        http://localhost/cgi-bin/?mode=%3Cscript%3Ealert(3)%3C%2Fscript%3E%0A