escape gravatar URLs to comply with W3C standards

This fixes an HTML validation error due to & not being properly escaped on the gravatar URLs.

See a validation report here:
http://validator.w3.org/check?uri=https%3A%2F%2Fmeta.discourse.org%2Ft%2Fconfiguring-facebook-login-for-discourse%2F13394&charset=%28detect+automatically%29&doctype=Inline&group=0