BUG ChangePasswordForm validation message should render HTML correctly.

HTML shows up in the form message escaped, but it shouldn't be, otherwise the list of password strength problems will look a bit broken. :)