So we don't get XSSed.
Might be useful to use heuristics to detect whether it's displayable as
text/plain, though.
Fixes: https://todo.sr.ht/~runxiyu/forge/20#event-411435
Previously when I was converting the fmt.Fprintln calls into http.Error,
there was a mistake in my sed command which caused some of the messages
to have double colons. This should fix them.