Manually escape browserid_common and remove double escaping on URLs.

fixes #47
Merge branch 'issue_47-escape_urls'