"Xss::filter" improperly converts htmlentites