don't always show error output inside a html comment
use ESAPI encodeForHTML on html formatted error messages