Add save(), even though it's not being used yet
Add setPassword() method to User class
HTML-escape error messages in TaskController

(Turns out it's really frustrating to debug a failing SQL statement that
has x<=y in it otherwise...)