web: don't echo back invalid service names

This prevents potential XSS attacks, which could have injected
arbitrary content under a domain by echoing back the unsupported
service name.

Found this patch lying around while I started doing other unrelated cleanups.