observe_field should escape the parameter it is submitting

The base forms of observe_field wind up with us generating javascript like

  parameters: 'q=' + value

value here is just the form elements value, which hasn't been escaped. It should be passed through encodeURIComponent or else the parameters get borked if you type an ampersand in the observed field.