URI escape the '&' character