escape ampersands in query strings