url unsafe parameter allowed also for mnemonic passwords