apply "extra" url_for hashed params to the url query

This updates the router so that you can pass "extra" hashed param
values and have them be added as query parameters on the generated
url.

I also added a helper module `Cgi` for doing some optimized cgi
handling for the query string generation.  It robustly builds
the query string given a hash value and escapes query values
appropriately.  Bringing in 'cgi' is not very memory-friendly and
this accomplishes the same effect.

@jcredding ready for review.