Ensure app origin is encoded (bug 1065006)

it would be double escaped, yeah