Invalid user supplied messages should be HTML entity escaped.

I also removed an unused import.