allow tokens (#, @, etc) to prefix or wrap autocomplete completions
escape input so it doesn't clobber regexp matching