fix incorrect injection of error messages

The error messages are not formatted as HTML and need to be injected
with textContent rather than innerHTML.

Thanks to Fabio Bonelli (@bfabio) for discovering this issue.