CDATA wasn't expanding entity references. Fixed.