ensure ampersands in URIs are xml-escaped
Merge pull request #21 from dsheets/uri-expander

ensure ampersands in URIs are xml-escaped