escape special xml chars as entities when serialized, fixes #10