Return safe HTML from all render()

Summary:
This is pretty brutal and it adds some `phutil_safe_html()`.
But it is a big step in the right direction.

Test Plan: None.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4905

src/applications/auth/controller/PhabricatorDisabledUserController.php

@@ -16,8 +16,8 @@ final class PhabricatorDisabledUserController
 
     $failure_view = new AphrontRequestFailureView();
     $failure_view->setHeader(pht('Account Disabled'));
-    $failure_view->appendChild(
-      '<p>'.pht('Your account has been disabled.').'</p>');
+    $failure_view->appendChild(phutil_tag('p', array(), pht(
+      'Your account has been disabled.')));
 
     return $this->buildStandardPageResponse(
       $failure_view,