use htmlspecialchars when returning HTML from HttpException to prevent XSS on errors