fixed escaping of character & in URLs