escape contributor names (using an XML Generator)

fixes #444