Fix #221 by doing some sanitization of user input (failed action) before just displaying it.

This could (should!) be more sophisticated but really folks should use their own custom error page that doesn't display any user input!