properly quote variables (fix missing globbing)