Specs: Tokeniser should return to return state, not data state; &#x; should not emit U+FFFD.

BUG=8

Review URL: https://codereview.chromium.org/650323005