properly escape HTTP post body