CDH-22184: Make sure web error messages are escaped for HTML

This patch moves error handling for the webserver to its own template,
which means it gets to take advantage of the escaping features that
templates have. The benefit is that if an error message includes
user-created content (which may be maliciously crafted), the webserver
escapes it and so it's unlikely to be executed by the client.

There are still ways to get unescaped HTML content, specifically by
requesting the JSON or 'raw' versions of a page. These pages are
returned with content-type 'text/plain', however, which means that
clients should not attempt to execute any scripts they contain.

Change-Id: I7d2e2f10748c6f27e110d7366ec1a8b54a44bc21
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/4775
Reviewed-by: Henry Robinson <henry@cloudera.com>
Tested-by: jenkins