don't decode entities

[freddyb]

as per gareth's comments on twitter https://twitter.com/garethheyes/status/327362562444382208, we should not decode entities.

[freddyb]

Test case: <'&lt;/script>&lt;img src=1 onerror=alert(1)>'>
Explanation: "if you are rewriting to code that mutates it's a problem regardless if it's a sandbox or not."

Solution: Don't decode entities? https://developer.mozilla.org/en-US/docs/Web/API/NodeIterator