Fix invalid markup in mail_to (ampersand not escaped)

Escape ampersands for validation.

It looks like this should probably be handled in the link_to helper, but I am not familiar enough with standards to know if `&` is supposed to be escaped in html tags in general.

Less hacky/more general solutions welcome to whoever knows more about the standards specs!