fix some 'format not a string literal's

Security issues, fixed according to https://fedoraproject.org/wiki/Format-Security-FAQ .