Escape attributes in server-side

[tonsky]

By @dwwoelfel:

I noticed that attributes aren't escaped when Rum builds html with its server-side rendering.

For example,

[:div {:className "\"><script>alert('hi')</script>"}]

is perfectly safe on the cljs side, but will alert if it's rendered on the server.

[CmdrDats]

+1 for this, having to manually escape this is a little painful - in my case, I'm doing a {:data-model (pr-str model)} on a tag to transfer the initial model into the components when the clojurescript upgrades the components to react.