quote vars to prevent word splitting

Otherwise paths with spaces might not work properly.
tar is too verbose