You should use the Hydra config values here instead of hardcoding the field names.  Also you should use `escape_filter` (https://github.com/projecthydra/hydra-head/blob/master/hydra-access-controls/lib/hydra/access_controls_enforcement.rb#L113) rather than trying to write your own escape sequence (line 22)