XML-escaping URLs because query parameters can have characters that conflict with XML.