Bring back the URL escaping code, but use a better character whitelist.

I realized we can still percent-encode some characters to guard against
URLs containing $(xterm) causing xterm to start on horrendously broken
systems. We just need to be better about what characters we escape. So
I brought back Tomasz's code, added a few characters to the allowed list,
and we now use the escaped URI when starting ALL browsers. Works fine for me.