Escape HTML in the 404 page.

There is a reflected XSS in the development mode 404 page for clients
that don't URL-encode the request path. (I'm not aware of any major
browsers that do this, but you can see the idea with cURL.)
Merge pull request #883 from ab/404-xss

Potential for reflected XSS in development mode 404 page