Fix tests due to differences in how updated Chrome returns HTML entities
Fix tests due to differences in how updated Chrome returns HTML entities

In either Chrome 73 or Chrome 74 (not exactly sure, but last worked in
Chrome 72), Capybara/Selenium now returns some HTML entities un-escaped
in certain contexts (eg, a "&gt;" inside an HTML attribute gets returned
as "<"). So update some of our XSS tests to deal with the new response
behavior.

Also add a more raw test with Curl to ensure that this is just a
Selenium issue and that the underlying HTML entities are in fact still
escaped as expected.

NREL/api-umbrella,NREL/api-umbrella,NREL/api-umbrella,NREL/api-umbrella