Add urlencode to request parameter

https://hackerone.com/reports/21081