Encode the history token before using it in a URL-ish context

The #replaceState() and #pushState() functions take a URL as optional third parameter,
so we need to ensure that that one is properly encoded.