Escape ampersands in URLs to make W3 validator happier

That old chestnut of "&" being what everyone enters for their URLs, but
HTML requires the & to be escaped as an entity because... science!

Signed-off-by: Dan Scott <dscott@laurentian.ca>