refs #18760 - only build CSV URL from permitted params

Prevents malicious data being injected into the URL options (e.g. host)
and prevents a security exception rendering URLs with non-sanitised
params under Rails 5.0.