encode per doctype

`&` should be encoded as `amp;`, yes even in a `src` attribute...