Customer search/create in admin order create uses unescaped user input as URL components

uc_order.js constructs URLs containing unescaped pieces of user-provided text data. This is a problem when in /admin/store/orders/create you search or create users with a firstname/lastname/email containing problematic characters such as "/" or "+".

The attached patch sends the data pieces I could find through encodeURIComponent().