Use `he` for robust HTML entity encoding/decoding

Closes #10.