Invalid user supplied messages should be escaped HTML entity escaped.

I also removed an unused import.