esc_url applied to readfile home_url()

This should fix it.

Thank you Mike for the info on esc_html.