can the url possibly contain non-std characters, like nul?