bug628796: now correctly escape '&amp;' as '&' when it appears in the mar url that we get from the update.xml file