client: use encodeURI on download links. closes #168
update to latest express/connect