set decodeEntities to false for dom-serializer so that it doesn't encode attribute values