Add changelog entry for #11.

Author: gsnedders

CHANGES.rst

@@ -1,6 +1,18 @@
 Change Log
 ----------
 
+0.999/1.0b4
+~~~~~~~~~~~
+
+Released on XXX
+
+* Fix #11, avoiding the XSS bug potentially caused by serializer allowing
+  attribute values to be escaped out of in old browser versions, changing the
+  quote_attr_values option on serializer to take one of three values,
+  "always" (the old True value), "legacy" (the new option, and the new
+  default), and "spec" (the old False value, and the old default).
+
+
 0.99
 ~~~~