Fixed: escaping html
Fixed: escaping :href value
Added: spec for escaping attribute values
Added: spec implementation