Replace ALL '&amp;'s in URLs with ampersands

Fixes 3364a5047 correctly. Previously only the first '\&amp;' got replaced.