ACDEV-1158: Escape HTML error responses

First I thought we could just change the content type for these responses to text/plain. But there is still a certain risk that browsers (especially older IEs) try to be smart and render the content as html.

So errors keep the text/html content type and the returned contents are being escaped.