[web] use url.QueryEscape rather than a silly string replace