String escaping - a safer solution

As discussed in issue #64, URLs with escaped values aren't handled correctly.  I think this is caused by a cross-browser issue with window.location.hash - unlike other browsers, Firefox %-unescapes the string before returning it.

The attached patch gets the hash from window.location.href (behaves identically cross-browser) and uses encodeURIComponent/decodeURIComponent instead of escape/unescape.