escape html entities, closes #12