deposit: Properly escape URLs
The '+' character in the 'after' was not escaped, so the server interpreted it as a space.