I tried all the methods: converting & to %26, converting & to \& and encapsulating the url with quotes. All give the same error.
Try sending your curl command to: http://localhost:8080/solr/debug/dumpWhen you are confident it is parsed properly, then try /update/csv -- the only way you can get the error you have is if "header=true" is not read properly.