Fix security issue reported earlier today...

Escape arguments passed to external plugins.

Fixes #61, Fixes #12.