Source code with ampersands isn't escaped properly in diffs.

In changeset diffs, source lines with HTML entities in them don't display properly. The entities aren't escaped, and so are output verbatim to the browser.

For example, in http://bitbucket.org/ned/coveragepy/changeset/ee491a08fa05/#chg-coverage/htmlfiles/pyfile.html, line 46 contains:

<span class="strut"> </span>

but looks like it is:

<span class="strut"> </span>