If the users email-address comes from an untrusted source, it can be
used to inject arbitrary HTML into the error pages.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2432 44740490-163a-0410-bde0-09ae8108e29a