properly escape filenames in export requests

http://manage.dimagi.com/default.asp?89954