properly escape unicode control characters

previously obfuscated code would produce invalid JSON containing
unescaped unicode control characters. This now escapes them correctly.