XML render safely escapes forbidden URI/URL chars.

 Using 'werkzeug.utils.escape' at the moment. I am in doubt wether
 'urllib.quote' would be a better option. In both circumstances the XML
 validates fine. I'm picking werkzeug because I URL escaped by its escape
 method works when  pasted in a browser bar, while a urllib quote doesn't. I'm
 open to suggestions on this one.

 Closes #99.