Avoid possible XSS attack when search highlighting is enabled.

Inject the highlighting HTML tags on the server side instead of using
JavaScript in the browser to do that.

Update rest-client to 5b6c5b3d6429952ddab62615fc2f528ef805bd75.

Fixes #819