escape package names correctly for unpublishing

Fixes npm/npm#5884.

/cc @bcoe @ceejbot