* In the JS, the Select2 ajax options require a url. If this url is encoded Select2 doesn't work.
* However esc_url & esc_js encodes all ampersands.
* This is not really an issue with Select2 - but actually making a normal jQuery.ajax call with an encoded url does not work either.
* The reason for this appears to be that it tries to add 'data' as query params. It cannot do this correctly unless ampersands are unencoded.

I can think of 3 ways round this problem
* Don't esc_url/esc_js on output, but do something else - eg make our own ajax_safe_esc function
* Convert escaped url to the valid format in JS.
* Use POST instead of GET... downside - it seemed cleaner to be able to add all the nonce stuff directly to the ajax_url rather than mixing it with the query params in the JS. But this actually works well.

I'm not sure what the best thing to do it.