renderers-html: only escape quotes in attributes, not in element bodies