rewrite unescapeEntities to the HTML spec; remove escaping functions