Fix escaping of XML

Right now `xml_escape returns a double escape string, eg:

    xml_escape("Dracula's") == "Dracula&amp;apos;"

Instead, this test should pass:

    assertEquals("Dracula&apos;s", xml_espcape("Dracula's")