Uses shellescape for serializing options for `env`

Prevents environment variables containing quotes from breaking
commandlines when shelling out.
test for #229 also protect weird values
Merge pull request #231 from heroku/merge-229

Merge shellescaping fixes.