dois are not html escaped

This causes problem e.g. for DOIs containing a `<`.