properly escape PicketLinks REST URL

Fixed a bug which prevented users with a password in PicketLink containing a '%' sign to log in when using CAS. Also, no longer print a problematic URL by default, as it may contain a plain-text password.