"&" breaks directories

[mjmunger]

The command polypy provision directory... produces invalid XML if a value in the provided CSV is an banned character for XML. For example, the label "S&S" breaks the XML, and needs to be replaced with "&" in order for the generated xml file to be valid.

Need to sanitize the CSV inputs.