Excape `&` when embedding XML in HTML