Attribute values should only be escaped when concatenated literally

This takes care of a bug where attribute values would sometimes have
html entities in them when the content was escaped. For example, & in
an attribute value string would show up as &amp; in the actual attribute
value.

The only case where we actually want to escape attributes in can.view
is when they're immediately concatenated because they're simple strings.
This test was not correctly testing the handling of unescaped attributes