Fix xss in errorpage

@martijnrusschen 

fixes https://hackerone.com/reports/18805