to_header now escapes auth_header string.

oauth2.client automatically includes the URL as the realm. This is fine,
but per the OAuth spec (http://oauth.net/core/1.0/), special charaters in
the realm should be escaped. Escaping the auth_header string brings oauth2
in compliance with the spec, and fixes an issue we had validating against
an oauth server.