Encode unsafe HTML chars in string values during serialization

This helps Express State protect against XSS attacks if untrust user
input it passed to `expose()` without being escaped first.

Fixes #11