More URL escaping, and unit tests

Found I had missed a couple of places where the URL needs to be escaped.
Added some unit tests to confirm.