Quote all params in auth_url except redirect_url

`client_id` may contain special characters (e.g. &).