update query endpoint to be a bit more resilient, and add escaping of special ES characters to search