This replaces the soft escaping ('&' -> '&') with strict escaping ('&' -> '&'). This new behavior matches that of Ruby and other Mustache implementations.
Other points:
- `dot_notation` currency is changed to use an ASCII character, since the JS interpreters did not appreciate unicode.
- Forward slash is added to escape list c/o OWASP recommendations.