replace & with &amp; in output to circumvent django's autoescaping; fixes #3