xhtml-combinators was being used only for it's text -> html escape function, and
even then that was only for the error page. Rather than bring in a new
dependency on this, I've rewritten the code to use blaze-html instead - which we
already have a transitive dependency on through heist. I've also used snap-blaze
to do the final rendering, so we can somewhat dog food our own libraries.