use a smarter regex when escaping html entities (<>&)

avoid escaping valid html character entities like &amp;

See discussion at: https://groups.google.com/d/msg/sproutcore-dev/IXcvzpVHZMw/9XD_U4OGecYJ