Explicitly set '&' as separator value for http_build_query in createAuthUrl

Implements defensive approach suggested in #76