[fix] Properly escape `name-ref` token values.