& shouldn't be HTML-encoded in URLs.