Escape apos

Escape apostrophe in `<%=`.  Include hex and decimal entities in the "entity-skipper" regexp as well.