fix html escaping, broken by change to mojo::util::xml_escape