Quote most variable references for safety

In bash, when strings are empty or have spaces in them, unquoted
expansion can cause weird stuff.