Fix escapeHtml for &, revert entity decoding to parser

escapeHtml was not escaping & as &amp; previously, so toHTML was returning incorrect html wherever literal & showed up

This fixes it and reverts the entity decoding back to the parser.