Disregarding the obvious ignorant comment about "security" related to showing the html for the page, looks like there's some buggy cache server (Cloudflare?) serving the wrong content type or something. Add "?aa" to the url or similar and it seems to work fine.