below do not support '. This makes package html consistent with package text/template's HTMLEscape function. Fixes #3489. R=rsc, mikesamuel, dsymonds CC=golang-dev https://golang.org/cl/5992071
