escape download handler URLs
esc_url_raw to readfile home_url()
esc_url applied to readfile home_url()

This should fix it.

Thank you Mike for the info on esc_html.
Allow custom checkout fields to be localized
Introduce woocommerce_pay_order_button_text and woocommerce_pay_order_button_html filters
Finnish with corrections, for WC 2.0.20
Merge pull request #4240 from Spreeuw/master

Allow custom checkout fields to be localized
Tweaks for #4239
woocommerce_checkout_customer_userdata filter Closes #4235
Set price slider min to min price. Closes #4183
Move sample tax rates Closes #4264
Inconsistent return types: TODOs
Suggested code changes in #4266
Clean up cancel_order and filter cancelable order status Closes #4257
Fixed faulty double return
Prevent error if variation doesn't exist.
Merge pull request #4260 from arhipaiva/master

Finnish with corrections, for WC 2.0.20
Merge pull request #4214 from toddlahman/master

escape download handler URLs
Esnure cron is scheduled for midnight Closes #4267
Use function for lost password url