fixup! Fix #11, #12: quote attributes that need escaping in legacy browsers