ensure all unsafe parts of URL are encoded