Add escaping to constants in urls

Since these constants can be defined by the user (in wp-config.php or
elsewhere), their value cannot be completely trusted, so escaping them
is necessary.