Comment 18 for bug 1407092

For what it's worth, Keystone had a similar bug that we simply said "wont fix" as sanitizing the response (don't render JSON as html) is largely the client's responsibility.

I believe this bug should be switched to public at this point.