use `entities.escape` for attribute values

partially fix for #319 (`&apos;` won't be used anymore)