XML escape fields for return invoices

Same type of thing as 3fa8c5bb5f6945dca7f33caea3d358361691636e.

Ticket ENG-683
2-2-dev spec fix

Our spree branch doesn't permit invalid zipcodes like this so we can't test bad zipcodes easily.