Don't escape plus signs in URLs (#621)

[Crozzers]

This PR fixes #621 by changing _html_escape_url to no longer escape + characters.

As pointed out in #621, + is a valid URL character, and therefore shouldn't be escaped in URLs.

I'm not sure exactly why they were being escaped in the first place, although it seems the first usage comes from 000343d as part of #230:

if safe_mode:
    escaped = quote_plus(attr).replace('+', ' ')

quote_plus replaces spaces with plus signs, and I'm guessing escapes some other characters too. They then go back and replace the plus signs with spaces again. Seems redundant and doesn't look like we need it

[nicholasserra]

Thanks!