make sure to encode URL components for API requests

Both notebook name and path can have spaces, hashes, other special characters. Most common characters didn't cause problems, but hashes certainly did.

This shouldn't be merged until I work out a test for it.

closes #4574
closes #4620