fix unescaped & in header