Quote shell commands in default settings.

Without this, the system can be compromized by URIs containing quote or
semicolon.