Make html.escape handle both bytes / string.

This fixes the bug from #108, though I'm not sure whether it handles all cases correctly?