collaborative
fix Mithgol/phido#3 better: only escape HTML in the error