Add a test to make sure XML is escaped properly

Presently fails due to inadequate output escaping.