Only encode unsafe and non-ASCII characters

Allow named character references in output (incompatible with older browsers)