Browser: escape server response to prevent XSS.

Fixes #2139