Invalid user supplied messages should be escaped HTML entity escaped.
Removed the <p> tag from the base file and added it to the template
Merge pull request #690 from levigross/master

Invalid user supplied messages should be HTML entity escaped.