Add some missing escaping

* URLs used in JS should be escaped with `esc_js`
* URLs used as query strings of another URL should be `urlencod`ed
Merge pull request #1 from jkudish/patch-1

Add some missing escaping