Web/Response: use & to encode XHR redirection URLs