Ensure that the URL generated for the OAuth authorization redirect isn't HTML-encoded.

Previously, ampersands in the URL were expanded to & a m p ; (without spaces), breaking at least Facebook's authorization screen.