Sanitizing input for error.php

Could be an xss issue in error.php – unchecked input.

The helper function `error()` has been modified to sanitize input. In
addition, error.php now tests a constant and throws 403 if not defined.
As far as I can tell, error.php should never be called in a situation
where common.php has not been included – only reason for constants to
be undefined is a direct browser request.