update url escaping to use cgi_escape