Escape &'s in href attributes (fixes #23)