BUG ChangePasswordForm validation message should render HTML correctly.

HTML shows up in the form message escaped, it shouldn't be, otherwise
the message looks broken.