url escape the participant name

Start on #312. Not closing it with this because it also reminds we need to check user access to that page.