gitweb: No error messages with unescaped/unprotected user input