escape download handler URLs
esc_url_raw to readfile home_url()
esc_url applied to readfile home_url()

This should fix it.

Thank you Mike for the info on esc_html.
Allow custom checkout fields to be localized
Introduce woocommerce_pay_order_button_text and woocommerce_pay_order_button_html filters
Inconsistent return types: mostly TODOs, some fixes
fixing county typo
Finnish with corrections, for WC 2.0.20
Merge pull request #4252 from tivnet/master

Inconsistent return types: mostly TODOs, some fixes
Removed a stray var dump and added braces
Code changes for #4252
Deprecated versions of void functions shouldn't return
Thumbnail upload buttons shouldn't be submit type. Closes #4263
Merge pull request #4255 from BFTrick/billing-state-desc-typo

Fixing County Typo
Merge pull request #4240 from Spreeuw/master

Allow custom checkout fields to be localized
Tweaks for #4239
woocommerce_checkout_customer_userdata filter Closes #4235
Set price slider min to min price. Closes #4183
Move sample tax rates Closes #4264
Inconsistent return types: TODOs