escape ampersand in urls so they're not interpreted by cmd

fixes #1

http://stackoverflow.com/a/1327476/64949
0.1.2