Add some missing escaping

* URLs used in JS should be escaped with `esc_js`
* URLs used as query strings of another URL should be `urlencod`ed