Escape incoming path params and outgoing path fields

This PR escapes inputs of the REST API, and path fields of models sent back to clients.