two phase operations
xml escape &'s in URLs