httputil.py: we must entity-encode & in URLs

A thorough discussion of this issue doesn't fit within the margins of
this commit message, but the omission of & was an oversight that I have
now fixed.