fixup! Rewrite escape() in htmlserializer to push onto a StrBuf.