Fix XSS in default theme.

Fixes #644 by escaping the URL in not found page.