Make sure that # can be used in auth browse

Because we use URLs to call the SuperCat browse API, we need to
be more careful about encoding parameters.  #, in particular, breaks
auth browse because it's seen as a URL fragment separator by the browser
and web server.

Signed-off-by: Mike Rylander <mrylander@gmail.com>
Signed-off-by: Yamil Suarez <yamil@yamil.com>
Signed-off-by: Mike Rylander <mrylander@gmail.com>