Use escapejs on URL and captions for file attachments.

Most URLs are fine, but in the case where we're using authenticated URLs with
S3, we'll have &amp; in the URL where we wanted &.