ensure ampersands in URIs are xml-escaped

This tweak to the tests makes sure that URIs in XML don't break the XML.