html5 named character references escapes, tokenizer fixes