Escape HTML from nodeValue

If there was existing escaped HTML, this plugin will un-escape it, causing issues.  Changed it to escape the nodeValue it originally gets.

Example:
In your version, replacing on the node
```html
<p>Hello &lt;script&gt;alert('hi');&lt;/script&gt;</p>
```
with regular expression `/Hello/` substituting for `'World'` will cause an alert.

This fix addresses that.

I also took out trailing whitespace that I found.

Note that I did not update the minified version.