use CGI escape to encode data values

Fixes #47 by using `CGI#escape` instead of `URI#escape` (only for data values within URIs).
Locally tested, mother approved.