[fix] encode HTML entities before setting content with .html()
Release 0.0.10