Twitter seems to perform some bizarre set of case logic on user.description. For example it allows “&” and “&” but strips “<”.
However a raw “&” in the description gets translated on twitter.com into an html-escaped proper “&”, whereas “&” stays as “&” and so both display on the webpage as simply “&”.
So, if it’s some hybrid of html-escaped and raw characters, what is the rule set for turning user.description into proper HTML?