v0.3.6: escape data URLs