Escape ampersands in non-HTML responses