add escapeEntities option

Also, I think we should use `&amp;` in the src instead of a bare `&`. The `&amp;` would be valid HTML.