add a test to highlight "non escaping of html entities contained in json strings", and fix this bug.