Avoid possible XSS attack when search highlighting is enabled.

Inject the highlighting HTML tags on the server side instead of using
JavaScript in the browser to do that.

Fixes #819