escape attribute values properly (#616)
Merge pull request #637 from ractivejs/gh-616

escape attribute values properly (#616)