header: escape &gt; correctly