Allow : in html-escaped strings