2.3: escape_once isn't escaping single quotes and is double-escaping hex-encoded entites

@tenderlove recently committed d549df7133f2b0bad8112890d478c33e990e12bc, which escapes single quotes :smile: :+1: , but escape_once still leaves them unescaped. And escape_once couldn't handle the hex-encoded entity, which caused it to be double-escaped.

i.e. ```escape_once("&#x27;") was returning "&amp;#x27;"```
and ```escape_once("'") was returning "'"```

Formtastic uses escape_once on field values, so it was causing text inputs containing single quotes to be double-escaped. So if the user submitted the form, it would be saved to the database escaped instead of raw.