Wrap track values in CDATA sections

Without CDATA it's not possible to embed some kinds of URLs in the `<location>` tags.

This branch is based off the composer branch so ping me when you've merged that one then I can rebase this.