http_get: apply http authentication credentials when provided

also, add CGI string escape