fixed handling of URLs with @ and : symbols in password