Clarify how escaping works for encrypting env vars

Fixes #389