BUG ChangePasswordForm validation message should render HTML correctly.

HTML shows up in the form message escaped, but it shouldn't be.