URL encode credentials before sending them to /settings

Most tokens break because the =s in them aren't escaped. This fixes that.