It was not being asserted anywhere else, and I was suspecting that
PR #552 was changing current (and correct) behaviour.

This closes a couple of potential exploit scenarios.
Backtick (`) for older IEs and equals (=) for unquoted attributes.

Refs 83b8e846a3
Closes https://github.com/janl/mustache.js/pull/388

- Cleaner separation of responsibilities in the code between
  scanning, parsing, compiling, and rendering functions.
- Much faster

This replaces the soft escaping ('&' -> '&') with strict escaping ('&' -> '&'). This new behavior matches that of Ruby and other Mustache implementations.

Other points:
- `dot_notation` currency is changed to use an ASCII character, since the JS interpreters did not appreciate unicode.
- Forward slash is added to escape list c/o OWASP recommendations.