[tokenizer] don't decode entities in special tags