URI escape in tomcat plugins

The old code combined strings without escaping, causing funny business when the
password contained characters that needed escaping.