avoid manually managing query strings

[demoray]

SAS tokens are query strings and follow the encoding rules required by Url query strings. Hand crafting Url query strings could lead us into failure points in the future.

This also removes the need for the internal note to ourselves to address in the future:

// splitting by & is only safe if & is not part of any fields
// if that changes in the future we might want to use a proper query string parser